text:
(a) This title does not apply to secured debts.

(b) This title does not require a court to order a claimant to refund any moneys already paid on a debt that is determined to be coerced.

(c) This title does not diminish the rights of a claimant to recover payment for a coerced debt from the person or persons who coerced a debtor into incurring that debt.

(d) This title does not reduce or eliminate any other rights or defenses available to a debtor or claimant pursuant to any other law.

title: 1.81.35. Coerced Debt


kind: section

code: CIV

text:
(a) Except as set forth in subdivision (b), this title applies only to debts incurred on or after July 1, 2023.

(b) Notwithstanding subdivision (a), a debtor may file a cross-complaint described by paragraph (2) of subdivision (a) of Section 1798.97.3 in an action filed by a claimant to collect a debt incurred prior to July 1, 2023, in which case, this title applies to that action, unless a final judgment has been entered in that action.

history: (History: Added by Stats. 2022, Ch. 989, Sec. 2. (SB 975) Effective January 1, 2023.)

title: 1.81.35. Coerced Debt

path: 1.81.35. Coerced Debt


text: If any provision of this title or the application thereof to any person or circumstances is held invalid, such invalidity shall not affect other provisions or applications of this title that can be given effect without the invalid provision or application, and to this end the provisions of this title are severable.

title: 1.81.35. Coerced Debt


text:
(a) For the purposes of this title, the following definitions shall apply:

(1) “Business” means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, chartered, or holding a license or authorization certificate under the law of this state, any other state, the United States, or of any other country, or the parent or the subsidiary of a financial institution.

(2) “Customer” means a customer of an electrical or gas corporation or a local publicly owned electric utility that permits a business to have access to data in association with purchasing or leasing a product or obtaining a service from the business.

(3) “Data” means a customer’s electrical or natural gas usage that is made available to the business as part of an advanced metering infrastructure provided by an electrical corporation, a gas corporation, or a local publicly owned electric utility, and includes the name, account number, or physical address of the customer.

(4) “Electrical corporation” has the same meaning as in Section 218 of the Public Utilities Code.

(5) “Gas corporation” has the same meaning as in Section 222 of the Public Utilities Code.

(6) “Local publicly owned electric utility” has the same meaning as in Section 224.3 of the Public Utilities Code.

(b) Unless otherwise required or authorized by federal or state law, a business shall not share, disclose, or otherwise make accessible to any third party a customer’s data without obtaining the express consent of the customer and conspicuously disclosing to whom the disclosure will be made and how the data will be used.

(c) A business that discloses data, with the express consent of the customer, pursuant to a contract with a nonaffiliated third party, shall require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the data from unauthorized access, destruction, use, modification, or disclosure.

(d) A business shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the data from unauthorized access, destruction, use, modification, or disclosure.

(e) A business shall not provide an incentive or discount to the customer for accessing the data without the prior consent of the customer.

(f) A business shall take all reasonable steps to dispose, or arrange for the disposal, of customer data within its custody or control when the records are no longer to be retained by the business by (1) shredding, (2) erasing, or (3) otherwise modifying the data in those records to make it unreadable or undecipherable through any means.

(g) The provisions of this section do not apply to an electrical corporation, a gas corporation, or a local publicly owned electric utility or a business that secures the data as a result of a contract with an electrical or gas corporation or a local publicly owned electric utility under the provisions of subdivision (f) of Section 8380 or subdivision (f) of 8381 of the Public Utilities Code.

history: (History: Amended by Stats. 2020, Ch. 188, Sec. 1. (AB 2788) Effective January 1, 2021.)

title: 1.81.4. PRIVACY OF CUSTOMER ELECTRICAL OR NATURAL GAS USAGE DATA


text:
(a) A customer harmed by the release or unauthorized use of his or her customer data, in violation of Section 1798.98, may bring a civil action to recover actual damages in an amount not to exceed five hundred dollars ($500) for each willful violation.

(b) The rights, remedies, and penalties established by this title are in addition to the rights, remedies, or penalties established under any other law.

(c) Nothing in this title shall abrogate any authority of the Attorney General to enforce existing law.

history: (History: Added by Stats. 2013, Ch. 597, Sec. 1. (AB 1274) Effective January 1, 2014.)

path: 1.81.4. PRIVACY OF CUSTOMER ELECTRICAL OR NATURAL GAS USAGE DATA


text:
(a) (1) A person or business that conducts business in California, and that seeks to sell any product or service in or into California that is illegal under state law to sell to a minor, as described in subdivisions (b) and (c), shall, notwithstanding any general term or condition, take reasonable steps to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser.

(2) Reasonable steps as used in paragraph (1) for the purchase of items described in subdivision (b) include, but are not limited to, any of the following:

(A) Requiring the purchaser or recipient to input, scan, provide, or display a government-issued identification, provided that the person or business complies with all laws governing the retention, use, and disclosure of personally identifiable information, including, but not limited to, subdivision (a) of Section 1749.65, paragraphs (3) to (7), inclusive, of subdivision (b) of, and subdivisions (c) to (f), inclusive, of, Section 1798.90, paragraph (1) of subdivision (a) of Section 1798.90.1, Sections 1798.29, 1798.81.5, and 1798.82, and Sections 22575 to 22579, inclusive, of the Business and Professions Code.

(B) Requiring the purchaser to use a nonprepaid credit card for an online purchase.

(C) Implementing a system that restricts individuals with accounts designated as minor accounts from purchasing the products listed in subdivision (b).

(D) Shipping the product or service to an individual who is of legal age.

(3) Reasonable steps as used in paragraph (1) for the purchase of items described in subdivision (c) include, but are not limited to, any of the following:

(A) Requiring the purchaser or recipient to input, scan, provide, or display a government-issued identification, provided that the person or business complies with all laws governing the retention, use, and disclosure of personally identifiable information, including, but not limited to, subdivision (a) of Section 1749.65, paragraphs (3) to (7), inclusive, of subdivision (b) of, and subdivisions (c) to (f), inclusive, of, Section 1798.90, paragraph (1) of subdivision (a) of Section 1798.90.1, Sections 1798.29, 1798.81.5, and 1798.82, and Sections 22575 to 22579, inclusive, of the Business and Professions Code.

(B) Shipping the product or service to an individual who is of legal age.

(4) Reasonable steps as used in paragraph (1) shall not include consent obtained through the minor.

(5) A seller’s reasonable and good faith reliance on bona fide evidence of the purchaser or recipient’s age shall constitute an affirmative defense to any action under this subdivision.

(6) A person or business required to comply with this section shall not retain, use, or disclose any information it receives from a purchaser or recipient in an effort to verify age pursuant to this section for any purpose other than as required to comply with, or as needed to demonstrate compliance with, this section, California law, or a state or federal court order.

(b) Products or services that are illegal to sell to a minor under state law that are subject to subdivision (a) include all of the following:

(1) An aerosol container of paint that is capable of defacing property, as referenced in Section 594.1 of the Penal Code.

(2) Etching cream that is capable of defacing property, as referenced in Section 594.1 of the Penal Code.

(3) Dangerous fireworks, as referenced in Sections 12505 and 12689 of the Health and Safety Code.

(4) Tanning in an ultraviolet tanning device, as referenced in Sections 22702 and 22706 of the Business and Professions Code.

(5) Dietary supplement products containing ephedrine group alkaloids, as referenced in Section 110423.2 of the Health and Safety Code.

(6) Body branding, as referenced in Sections 119301 and 119302 of the Health and Safety Code.

(c) Products or services that are illegal to sell to a minor under state law that are subject to subdivision (a) include all of the following:

(1) Firearms or handguns, as referenced in Sections 16520, 16640, and 27505 of the Penal Code.

(2) A BB device, as referenced in Sections 16250 and 19910 of the Penal Code.

(3) Ammunition or reloaded ammunition, as referenced in Sections 16150 and 30300 of the Penal Code.

(4) Any tobacco, cigarette, cigarette papers, blunt wraps, any other preparation of tobacco, any other instrument or paraphernalia that is designed for the smoking or ingestion of tobacco, products prepared from tobacco, or any controlled substance, as referenced in Division 8.5 (commencing with Section 22950) of the Business and Professions Code, and Sections 308, 308.1, 308.2, and 308.3 of the Penal Code.

(5) Electronic cigarettes, as referenced in Section 119406 of the Health and Safety Code.

(6) A less lethal weapon, as referenced in Sections 16780 and 19405 of the Penal Code.

(d) In an action brought by a public prosecutor, a business or person that violates this section shall be subject to a civil penalty not exceeding seven thousand five hundred dollars ($7,500) for each violation.

(e) The provisions of this section do not apply to a business that is regulated by state or federal law providing greater protection to personal information or requiring greater age verification than provided by this section in regard to the subjects addressed by this section. Compliance with state or federal law shall be deemed compliance with this section with regard to those subjects. This subdivision does not relieve a business from a duty to comply with any other requirements of other state and federal law regarding the protection and privacy of personal information or age verification.

(f) For purposes of this section, a government-issued identification means any of the following:

(1) A document issued by a federal, state, county, or municipal government, or subdivision or agency thereof, including, but not limited to, an identification card or a valid motor vehicle operator’s license, including licenses or identification cards issued pursuant to Section 12801.9 of the Vehicle Code, that contains the name, date of birth, description, and picture of the person.

(2) A valid passport issued by the United States or by a foreign government.

(3) A valid identification card issued to a member of the United States Armed Forces that includes the date of birth and picture of the person.

(4) A valid consular identification document.

(5) An identification card issued by a federally recognized tribal government.

(g) This section shall become operative on January 1, 2020.

history: (History: Amended by Stats. 2022, Ch. 482, Sec. 1. (AB 1766) Effective January 1, 2023.)

title: 1.81.45. The Parent’s Accountability and Child Protection Act


text:
For purposes of this section:

(a) (1) “Content” means statements or comments made by users and media that are created, posted, shared, or otherwise interacted with by users on an internet-based service or application.

(2) “Content” does not include media put on a service or application exclusively for the purpose of cloud storage, transmitting files, or file collaboration.

(b) “Social media platform” means a public or semipublic internet-based service or application that has users in California and that meets both of the following criteria:

(1) (A) A substantial function of the service or application is to connect users in order to allow users to interact socially with each other within the service or application.

(B) A service or application that provides email or direct messaging services shall not be considered to meet this criterion on the basis of that function alone.

(2) The service or application allows users to do all of the following:

(A) Construct a public or semipublic profile for purposes of signing into and using the service or application.

(B) Populate a list of other users with whom an individual shares a social connection within the system.

(C) Create or post content viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users.

(c) “Public or semipublic internet-based service or application” does not include a service or application used to facilitate communication with a business or enterprise among employees or affiliates of the business or enterprise, provided that access to the service or application is restricted to employees or affiliates of the business or enterprise using the service or application.

(d) “User” means a person with an account on a social media platform.

(e) “Violent post” means content on a social media platform that contains a true threat against a specific person that is not protected by the First Amendment to the United States Constitution.

history: (History: Added by Stats. 2022, Ch. 881, Sec. 1. (SB 1056) Effective January 1, 2023.)

title: 1.81.46. Online Violence Prevention Act

path: 1.81.46. Online Violence Prevention Act


text:
(a) A social media platform shall clearly and conspicuously state whether it has a mechanism for reporting violent posts that is available to users and nonusers of the platform.

(b) If the social media platform has a reporting mechanism, the statement required by this subdivision shall include a link to the reporting mechanism.

title: 1.81.46. Online Violence Prevention Act


text:
(a) (1) (A) A person who is the target of a violent post, or reasonably believes the person is the target of a violent post, may seek an order requiring the social media platform to remove the violent post and any related violent post the court determines shall be removed in the interests of justice.

(B) (i) A person may bring an action pursuant to this paragraph before 48 hours have passed since providing notice to a social media platform pursuant to paragraph (2), but the court shall not rule on the request for an order until 48 hours have passed from the provision of notice.

(ii) The court may dismiss an action described by clause (i) if the social media platform deletes the post before 48 hours have passed from the provision of notice.

(C) Except as provided in subparagraph (D), a person may bring an action pursuant to this paragraph at any time, and the court may rule on the request at any time, if the social media platform does not have a reporting mechanism described in Section 1798.99.21.

(D) A person shall not bring an action pursuant to this paragraph, nor shall a court issue an order requiring a social medial platform to remove a violent post or any related violent post, based upon content containing a true threat against a specific person if the date and time when the true threat that was threatened to occur has passed.

(2) If the social media platform has a reporting mechanism described in Section 1798.99.21, a person shall not bring an action pursuant to paragraph (1) until the person has notified the social media platform of the violent post and requested that it be removed through the reporting mechanism.

(b) (1) A court shall award court costs and reasonable attorney’s fees to a prevailing plaintiff in an action brought pursuant to this section.

(2) Reasonable attorney’s fees may be awarded to a prevailing defendant upon a finding by the court that the plaintiff’s prosecution of the action was not in good faith.

title: 1.81.46. Online Violence Prevention Act


text: This title does not apply to a social media platform with fewer than 1,000,000 discrete monthly users.

title: 1.81.46. Online Violence Prevention Act


text: This title shall be known, and may be cited, as the California Age-Appropriate Design Code Act.

history: (History: Added by Stats. 2022, Ch. 320, Sec. 2. (AB 2273) Effective January 1, 2023.)

title: 1.81.47. The California Age-Appropriate Design Code Act


text:
The Legislature declares that children should be afforded protections not only by online products and services specifically directed at them but by all online products and services they are likely to access and makes the following findings:

(a) Businesses that develop and provide online services, products, or features that children are likely to access should consider the best interests of children when designing, developing, and providing that online service, product, or feature.

(b) If a conflict arises between commercial interests and the best interests of children, companies should prioritize the privacy, safety, and well-being of children over commercial interests.

path: 1.81.47. The California Age-Appropriate Design Code Act


text:
(a) For purposes of this title, the definitions in Section 1798.140 shall apply unless otherwise specified in this title.

(b) For the purposes of this title:

(1) “Child” or “children,” unless otherwise specified, means a consumer or consumers who are under 18 years of age.

(2) “Data Protection Impact Assessment” means a systematic survey to assess and mitigate risks that arise from the data management practices of the business to children who are reasonably likely to access the online service, product, or feature at issue that arises from the provision of that online service, product, or feature.

(3) “Default” means a preselected option adopted by the business for the online service, product, or feature.

(4) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children:

(A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.).

(B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.

(C) An online service, product, or feature with advertisements marketed to children.

(D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).

(E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.

(F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.

(5) “Online service, product, or feature” does not mean any of the following:

(A) A broadband internet access service, as defined in Section 3100.

(B) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.

(C) The delivery or use of a physical product.

(6) “Profiling” means any form of automated processing of personal information that uses personal information to evaluate certain aspects relating to a natural person, including analyzing or predicting aspects concerning a natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.


text:
(a) A business that provides an online service, product, or feature likely to be accessed by children shall take all of the following actions:

(1) (A) Before any new online services, products, or features are offered to the public, complete a Data Protection Impact Assessment for any online service, product, or feature likely to be accessed by children and maintain documentation of this assessment as long as the online service, product, or feature is likely to be accessed by children. A business shall biennially review all Data Protection Impact Assessments.

(B) The Data Protection Impact Assessment required by this paragraph shall identify the purpose of the online service, product, or feature, how it uses children’s personal information, and the risks of material detriment to children that arise from the data management practices of the business. The Data Protection Impact Assessment shall address, to the extent applicable, all of the following:

(i) Whether the design of the online product, service, or feature could harm children, including by exposing children to harmful, or potentially harmful, content on the online product, service, or feature.

(ii) Whether the design of the online product, service, or feature could lead to children experiencing or being targeted by harmful, or potentially harmful, contacts on the online product, service, or feature.

(iii) Whether the design of the online product, service, or feature could permit children to witness, participate in, or be subject to harmful, or potentially harmful, conduct on the online product, service, or feature.

(iv) Whether the design of the online product, service, or feature could allow children to be party to or exploited by a harmful, or potentially harmful, contact on the online product, service, or feature.

(v) Whether algorithms used by the online product, service, or feature could harm children.

(vi) Whether targeted advertising systems used by the online product, service, or feature could harm children.

(vii) Whether and how the online product, service, or feature uses system design features to increase, sustain, or extend use of the online product, service, or feature by children, including the automatic playing of media, rewards for time spent, and notifications.

(viii) Whether, how, and for what purpose the online product, service, or feature collects or processes sensitive personal information of children.

(2) Document any risk of material detriment to children that arises from the data management practices of the business identified in the Data Protection Impact Assessment required by paragraph (1) and create a timed plan to mitigate or eliminate the risk before the online service, product, or feature is accessed by children.

(3) Within three business days of a written request by the Attorney General, provide to the Attorney General a list of all Data Protection Impact Assessments the business has completed.

(4) (A) For any Data Protection Impact Assessment completed pursuant to paragraph (1), make the Data Protection Impact Assessment available, within five business days, to the Attorney General pursuant to a written request.

(B) Notwithstanding any other law, a Data Protection Impact Assessment is protected as confidential and shall be exempt from public disclosure, including under the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code).

(C) To the extent any information contained in a Data Protection Impact Assessment disclosed to the Attorney General includes information subject to attorney-client privilege or work product protection, disclosure pursuant to this paragraph shall not constitute a waiver of that privilege or protection.

(5) Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers.

(6) Configure all default privacy settings provided to children by the online service, product, or feature to settings that offer a high level of privacy, unless the business can demonstrate a compelling reason that a different setting is in the best interests of children.

(7) Provide any privacy information, terms of service, policies, and community standards concisely, prominently, and using clear language suited to the age of children likely to access that online service, product, or feature.

(8) If the online service, product, or feature allows the child’s parent, guardian, or any other consumer to monitor the child’s online activity or track the child’s location, provide an obvious signal to the child when the child is being monitored or tracked.

(9) Enforce published terms, policies, and community standards established by the business, including, but not limited to, privacy policies and those concerning children.

(10) Provide prominent, accessible, and responsive tools to help children, or if applicable their parents or guardians, exercise their privacy rights and report concerns.

(b) A business that provides an online service, product, or feature likely to be accessed by children shall not take any of the following actions:

(1) Use the personal information of any child in a way that the business knows, or has reason to know, is materially detrimental to the physical health, mental health, or well-being of a child.

(2) Profile a child by default unless both of the following criteria are met:

(A) The business can demonstrate it has appropriate safeguards in place to protect children.

(B) Either of the following is true:

(i) Profiling is necessary to provide the online service, product, or feature requested and only with respect to the aspects of the online service, product, or feature with which the child is actively and knowingly engaged.

(ii) The business can demonstrate a compelling reason that profiling is in the best interests of children.

(3) Collect, sell, share, or retain any personal information that is not necessary to provide an online service, product, or feature with which a child is actively and knowingly engaged, or as described in subparagraphs (A) to (D), inclusive, of paragraph (1) of subdivision (a) of Section 1798.145, unless the business can demonstrate a compelling reason that the collecting, selling, sharing, or retaining of the personal information is in the best interests of children likely to access the online service, product, or feature.

(4) If the end user is a child, use personal information for any reason other than a reason for which that personal information was collected, unless the business can demonstrate a compelling reason that use of the personal information is in the best interests of children.

(5) Collect, sell, or share any precise geolocation information of children by default unless the collection of that precise geolocation information is strictly necessary for the business to provide the service, product, or feature requested and then only for the limited time that the collection of precise geolocation information is necessary to provide the service, product, or feature.

(6) Collect any precise geolocation information of a child without providing an obvious sign to the child for the duration of that collection that precise geolocation information is being collected.

(7) Use dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections, or to take any action that the business knows, or has reason to know, is materially detrimental to the child’s physical health, mental health, or well-being.

(8) Use any personal information collected to estimate age or age range for any other purpose or retain that personal information longer than necessary to estimate age. Age assurance shall be proportionate to the risks and data practice of an online service, product, or feature.

(c) (1) A Data Protection Impact Assessment conducted by a business for the purpose of compliance with any other law complies with this section if the Data Protection Impact Assessment meets the requirements of this title.

(2) A single data protection impact assessment may contain multiple similar processing operations that present similar risks only if each relevant online service, product, or feature is addressed.

(d) This section shall become operative on July 1, 2024.

history: (History: Amended by Stats. 2024, Ch. 80, Sec. 21. (SB 1525) Effective January 1, 2025.)


text:
(a) The California Children’s Data Protection Working Group is hereby created within the Office of the Attorney General to deliver a report to the Legislature, pursuant to subdivision (e), regarding best practices for the implementation of this title.

(b) Working group members shall consist of Californians with expertise in at least two of the following areas:

(1) Children’s data privacy.

(2) Physical health.

(3) Mental health and well-being.

(4) Computer science.

(5) Children’s rights.

(c) The working group shall select a chair and a vice chair from among its members and shall consist of the following nine members:

(1) Two appointees by the Governor.

(2) Two appointees by the President Pro Tempore of the Senate.

(3) Two appointees by the Speaker of the Assembly.

(4) Two appointees by the Attorney General.

(5) One appointee by the California Privacy Protection Agency.

(d) The working group shall take input from a broad range of stakeholders, including from academia, consumer advocacy groups, and small, medium, and large businesses affected by data privacy policies and shall make recommendations to the Legislature on best practices regarding, at minimum, all of the following:

(1) Identifying online services, products, or features likely to be accessed by children.

(2) Evaluating and prioritizing the best interests of children with respect to their privacy, physical health, and mental health and well-being and evaluating how those interests may be furthered by the design, development, and implementation of an online service, product, or feature.

(3) Ensuring that age assurance methods used by businesses that provide online services, products, or features likely to be accessed by children are proportionate to the risks that arise from the data management practices of the business, privacy protective, and minimally invasive.

(4) Assessing and mitigating risks to children that arise from the use of an online service, product, or feature.

(5) Publishing privacy information, policies, and standards in concise, clear language suited for the age of children likely to access an online service, product, or feature.

(6) How the working group and the Department of Justice may leverage the substantial and growing expertise of the California Privacy Protection Agency in the long-term development of data privacy policies that affect the privacy, rights, and safety of children online.

(e) On or before July 1, 2024, and every two years thereafter, the working group shall submit, pursuant to Section 9795 of the Government Code, a report to the Legislature regarding the recommendations described in subdivision (d).

(f) A meeting of the members of the working group may be conducted, in whole or in part, by electronic transmission, electronic video screen communication, conference telephone, or other means of remote communication.

(g) The members of the working group shall serve without compensation but shall be reimbursed for all necessary expenses actually incurred in the performance of their duties.

(h) This section shall remain in effect until January 1, 2030, and as of that date is repealed.

history: (History: Amended by Stats. 2023, Ch. 45, Sec. 1. (AB 127) Effective July 10, 2023. Repealed as of January 1, 2030, by its own provisions.)


text:
(a) A business shall complete a Data Protection Impact Assessment on or before July 1, 2024, for any online service, product, or feature likely to be accessed by children offered to the public before July 1, 2024.

(b) This section does not apply to an online service, product, or feature that is not offered to the public on or after July 1, 2024.


text:
(a) Any business that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.

(b) Any penalties, fees, and expenses recovered in an action brought under this title shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the Attorney General in connection with this title.

(c) (1) If a business is in substantial compliance with the requirements of paragraphs (1) through (4), inclusive, of subdivision (a) of Section 1798.99.31, the Attorney General shall provide written notice to the business, before initiating an action under this title, identifying the specific provisions of this title that the Attorney General alleges have been or are being violated.

(2) If, within 90 days of the notice required by this subdivision, the business cures any noticed violation and provides the Attorney General a written statement that the alleged violations have been cured, and sufficient measures have been taken to prevent future violations, the business shall not be liable for a civil penalty for any violation cured pursuant to this subdivision.

(d) Nothing in this title shall be interpreted to serve as the basis for a private right of action under this title or any other law.

(e) The Attorney General may solicit broad public participation and adopt regulations to clarify the requirements of this title.


text: This title does not apply to the information or entities described in subdivision (c) of Section 1798.145.


text:
For purposes of this title:

(a) The definitions in Section 1798.140 shall apply unless otherwise specified in this title.

(b) “Authorized agent” has the same meaning as used in Chapter 1 (commencing with Section 7000) of Division 6 of Title 11 of the California Code of Regulations.

(c) “Data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. “Data broker” does not include any of the following:

(1) An entity to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).

(2) An entity to the extent that it is covered by the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations.

(3) An entity to the extent that it is covered by the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code).

(4) An entity, or a business associate of a covered entity, to the extent their processing of personal information is exempt under Section 1798.146. For purposes of this paragraph, “business associate” and “covered entity” have the same meanings as defined in Section 1798.146.

history: (History: Amended by Stats. 2023, Ch. 709, Sec. 1. (SB 362) Effective January 1, 2024.)

title: 1.81.48. Data Broker Registration

path: 1.81.48. Data Broker Registration


text:
A fund to be known as the “Data Brokers’ Registry Fund” is hereby created within the State Treasury. The fund shall be administered by the California Privacy Protection Agency. All moneys collected or received by the California Privacy Protection Agency and the Department of Justice under this title shall be deposited into the Data Brokers’ Registry Fund, to be available for expenditure by the California Privacy Protection Agency, upon appropriation by the Legislature, to offset all of the following costs:

(a) The reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.

(b) The costs incurred by the state courts and the California Privacy Protection Agency in connection with enforcing this title, as specified in Section 1798.99.82.

(c) The reasonable costs of establishing, maintaining, and providing access to the accessible deletion mechanism described in Section 1798.99.86.

history: (History: Amended by Stats. 2023, Ch. 709, Sec. 2. (SB 362) Effective January 1, 2024.)

title: 1.81.48. Data Broker Registration


text:
(a) On or before January 31 following each year in which a business meets the definition of data broker as provided in this title, the business shall register with the California Privacy Protection Agency pursuant to the requirements of this section.

(b) In registering with the California Privacy Protection Agency, as described in subdivision (a), a data broker shall do all of the following:

(1) Pay a registration fee in an amount determined by the California Privacy Protection Agency, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84 and the reasonable costs of establishing, maintaining, and providing access to the accessible deletion mechanism described in Section 1798.99.86. Registration fees shall be deposited in the Data Brokers’ Registry Fund, created within the State Treasury pursuant to Section 1798.99.81, and used for the purposes outlined in this paragraph.

(2) Provide the following information:

(A) The name of the data broker and its primary physical, email, and internet website addresses.

(B) The metrics compiled pursuant to paragraphs (1) and (2) of subdivision (a) of Section 1798.99.85.

(C) Whether the data broker collects the personal information of minors.

(D) Whether the data broker collects consumers’ names, dates of birth, ZIP Codes, email addresses, or phone numbers.

(E) Whether the data broker collects consumers’ account login or account number in combination with any required security code, access code, or password that would permit access to a consumer’s account with a third party.

(F) Whether the data broker collects consumers’ drivers’ license number, California identification card number, tax identification number, social security number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual.

(G) Whether the data broker collects consumers’ mobile advertising identification numbers, connected television identification numbers, or vehicle identification numbers (VIN).

(H) Whether the data broker collects consumers’ citizenship data, including immigration status.

(I) Whether the data broker collects consumers’ union membership status.

(J) Whether the data broker collects consumers’ sexual orientation status.

(K) Whether the data broker collects consumers’ gender identity and gender expression data.

(L) Whether the data broker collects consumers’ biometric data.

(M) Whether the data broker collects consumers’ precise geolocation.

(N) Whether the data broker collects consumers’ reproductive health care data.

(O) Whether the data broker has shared or sold consumers’ data to a foreign actor in the past year.

(P) Whether the data broker has shared or sold consumers’ data to the federal government in the past year.

(Q) Whether the data broker has shared or sold consumers’ data to other state governments in the past year.

(R) Whether the data broker has shared or sold consumers’ data to law enforcement in the past year, unless that data was shared pursuant to a subpoena or court order.

(S) Whether the data broker has shared or sold consumers’ data to a developer of a GenAI system or model in the past year.

(T) Up to three, but no fewer than one, of the most common types of personal information that the data broker collects, if the data broker does not collect the information described in subparagraphs (D) and (G).

(U) Beginning January 1, 2029, whether the data broker has undergone an audit as described in subdivision (e) of Section 1798.99.86, and, if so, the most recent year that the data broker has submitted a report resulting from the audit and any related materials to the California Privacy Protection Agency.

(V) A link to a page on the data broker’s internet website that does both of the following:

(i) Details how consumers may exercise their privacy rights by doing all of the following:

(I) Deleting personal information, as described in Section 1798.105.

(II) Correcting inaccurate personal information, as described in Section 1798.106.

(III) Learning what personal information is being collected and how to access that personal information, as described in Section 1798.110.

(IV) Learning what personal information is being sold or shared and to whom, as described in Section 1798.115.

(V) Learning how to opt out of the sale or sharing of personal information, as described in Section 1798.120.

(VI) Learning how to limit the use and disclosure of sensitive personal information, as described in Section 1798.121.

(ii) Does not make use of any dark patterns.

(W) Whether and to what extent the data broker or any of its subsidiaries is regulated by any of the following:

(i) The federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).

(ii) The Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations.

(iii) The Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code).

(iv) The Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191).

(X) Any additional information or explanation the data broker chooses to provide concerning its data collection practices.

(c) A data broker that fails to register as required by this section is liable for administrative fines and costs in an administrative action brought by the California Privacy Protection Agency as follows:

(1) An administrative fine of two hundred dollars ($200) for each day the data broker fails to register as required by this section.

(2) An amount equal to the fees that were due during the period it failed to register.

(3) Reasonable expenses incurred by the California Privacy Protection Agency in the investigation and administration of the action.

(d) A data broker required to register under this title that fails to comply with the requirements of Section 1798.99.86 is liable for administrative fines and costs in an administrative action brought by the California Privacy Protection Agency as follows:

(1) An administrative fine of two hundred dollars ($200) for each deletion request for each day the data broker fails to delete information as required by Section 1798.99.86.

(2) Reasonable expenses incurred by the California Privacy Protection Agency in the investigation and administration of the action.

(e) Any penalties, fines, fees, and expenses recovered in an action prosecuted under subdivision (c) or (d) shall be deposited in the Data Brokers’ Registry Fund, created within the State Treasury pursuant to Section 1798.99.81, with the intent that they be used to fully offset costs incurred by the state courts and the California Privacy Protection Agency in connection with this title.

(f) For purposes of this section, the following definitions apply:

(1) (A) “Foreign actor” means either of the following:

(i) The government of a foreign adversary country.

(ii) A partnership, association, corporation, organization, or other combination of persons organized under the laws of or having its principal place of business in a foreign adversary country.

(B) For purposes of subparagraph (A), “foreign adversary country” has the same meaning as “covered nation” as defined in Section 4872 of Title 10 of the United States Code.

(2) “Developer of a GenAI system” means a business, person, partnership, corporation, or other entity that designs, codes, produces, or substantially modifies a GenAI system.

(3) “Generative artificial intelligence system” or “GenAI system” means an artificial intelligence that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system’s training data.

history: (History: Amended by Stats. 2025, Ch. 466, Sec. 1. (SB 361) Effective January 1, 2026.)

title: 1.81.48. Data Broker Registration


text:
(a) The California Privacy Protection Agency shall create a page on its internet website where the registration information provided by data brokers described in paragraph (2) of subdivision (b) of Section 1798.99.82, except as provided in subdivision (b), and the accessible deletion mechanism described in Section 1798.99.86 shall be accessible to the public.

(b) Information provided by a data broker pursuant to subparagraphs (D), (G), and (T) of paragraph (2) of subdivision (b) of Section 1798.99.82 shall not be made accessible to the public on the California Privacy Protection Agency’s internet website.

history: (History: Amended by Stats. 2025, Ch. 466, Sec. 2. (SB 361) Effective January 1, 2026.)

title: 1.81.48. Data Broker Registration


text:
(a) On or before July 1 following each calendar year in which a business meets the definition of a data broker as provided in this title, the business shall do all of the following:

(1) Compile the number of requests pursuant to subdivision (c) of Section 1798.99.86 and Sections 1798.105, 1798.110, 1798.115, 1798.120, and 1798.121 that the data broker received, complied with in whole or in part, and denied during the previous calendar year.

(2) Compile the median and the mean number of days within which the data broker substantively responded to requests pursuant to subdivision (c) of Section 1798.99.86 and Sections 1798.105, 1798.110, 1798.115, 1798.120, and 1798.121 that the data broker received during the previous calendar year.

(3) Disclose the metrics compiled pursuant to paragraphs (1) and (2) within the data broker’s privacy policy posted on their internet website and accessible from a link included in the data broker’s privacy policy.

(b) In its disclosure pursuant to paragraph (3) of subdivision (a) regarding requests made pursuant to subdivision (c) of Section 1798.99.86, a data broker shall disclose the number of requests that the data broker denied in whole or in part because of any of the following:

(1) The request was not verifiable.

(2) The request was not made by a consumer.

(3) The request called for information exempt from deletion.

(4) The request was denied on other grounds.

(c) In its disclosure pursuant to paragraph (3) of subdivision (a), a data broker shall, for each provision of Section 1798.145 or 1798.146 under which deletion was not required, specify the number of requests in which deletion was not required in whole, or in part, under that provision.

history: (History: Added by Stats. 2023, Ch. 709, Sec. 5. (SB 362) Effective January 1, 2024.)

title: 1.81.48. Data Broker Registration


text:
(a) By January 1, 2026, the California Privacy Protection Agency shall establish an accessible deletion mechanism that does all of the following:

(1) Implements and maintains reasonable security procedures and practices, including, but not limited to, administrative, physical, and technical safeguards appropriate to the nature of the information and the purposes for which the personal information will be used and to protect consumers’ personal information from unauthorized use, disclosure, access, destruction, or modification.

(2) Allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor.

(3) Allows a consumer to selectively exclude specific data brokers from a request made under paragraph (2).

(4) Allows a consumer to make a request to alter a previous request made under this subdivision after at least 45 days have passed since the consumer last made a request under this subdivision.

(b) The accessible deletion mechanism established pursuant to subdivision (a) shall meet all of the following requirements:

(1) The accessible deletion mechanism shall allow a consumer to request the deletion of all personal information related to that consumer through a single deletion request.

(2) The accessible deletion mechanism shall permit a consumer to securely submit information in one or more privacy-protecting ways determined by the California Privacy Protection Agency to aid in the deletion request.

(3) The accessible deletion mechanism shall allow data brokers registered with the California Privacy Protection Agency to determine whether an individual has submitted a verifiable consumer request to delete the personal information related to that consumer as described in paragraph (1) and shall not allow the disclosure of any additional personal information when the data broker accesses the accessible deletion mechanism unless otherwise specified in this title.

(4) The accessible deletion mechanism shall allow a consumer to make a request described in paragraph (1) using an internet service operated by the California Privacy Protection Agency.

(5) The accessible deletion mechanism shall not charge a consumer to make a request described in paragraph (1).

(6) The accessible deletion mechanism shall allow a consumer to make a request described in paragraph (1) in any language spoken by any consumer for whom personal information has been collected by data brokers.

(7) The accessible deletion mechanism shall be readily accessible and usable by consumers with disabilities.

(8) The accessible deletion mechanism shall support the ability of a consumer’s authorized agents to aid in the deletion request.

(9) The accessible deletion mechanism shall allow the consumer, or their authorized agent, to verify the status of the consumer’s deletion request.

(10) The accessible deletion mechanism shall provide a description of all of the following:

(A) The deletion permitted by this section, including, but not limited to, the actions required by subdivisions (c) and (d).

(B) The process for submitting a deletion request pursuant to this section.

(C) Examples of the types of information that may be deleted.

(c) (1) Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism established pursuant to subdivision (a) at least once every 45 days and do all of the following:

(A) Within 45 days after receiving a request made pursuant to this section, process all deletion requests made pursuant to this section and delete all personal information related to the consumers making the requests consistent with the requirements of this section.

(B) In cases where a data broker denies a consumer request to delete under this title because the request cannot be verified, process the request as an opt-out of the sale or sharing of the consumer’s personal information, as provided for under Section 1798.120 and limited by Sections 1798.105, 1798.145, and 1798.146, within 45 days of receiving the request.

(C) Direct all service providers or contractors associated with the data broker to delete all personal information in their possession related to the consumers making the requests described in subparagraph (A).

(D) Direct all service providers or contractors associated with the data broker to process a request described by subparagraph (B) as an opt-out of the sale or sharing of the consumer’s personal information, as provided for under Section 1798.120 and limited by Sections 1798.105, 1798.145, and 1798.146.

(2) Notwithstanding paragraph (1), a data broker shall not be required to delete a consumer’s personal information if either of the following apply:

(A) It is reasonably necessary for the data broker to maintain the personal information to fulfill a purpose described in subdivision (d) of Section 1798.105.

(B) The deletion is not required pursuant to Section 1798.145 or 1798.146.

(3) Personal information described in paragraph (2) shall only be used for the purposes described in paragraph (2) and shall not be used or disclosed for any other purpose, including, but not limited to, marketing purposes.

(d) (1) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall delete all personal information of the consumer at least once every 45 days pursuant to this section unless the consumer requests otherwise or the deletion is not required pursuant to paragraph (2) of subdivision (c).

(2) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall not sell or share new personal information of the consumer unless the consumer requests otherwise or selling or sharing the personal information is permitted under Section 1798.145 or 1798.146.

(e) (1) Beginning January 1, 2028, and every three years thereafter, a data broker shall undergo an audit by an independent third party to determine compliance with this section.

(2) For an audit completed pursuant to paragraph (1), the data broker shall submit a report resulting from the audit and any related materials to the California Privacy Protection Agency within five business days of a written request from the California Privacy Protection Agency.

(3) A data broker shall maintain the report and materials described in paragraph (2) for at least six years.

(f) (1) The California Privacy Protection Agency may charge an access fee to a data broker when the data broker accesses the accessible deletion mechanism pursuant to subdivision (c) that does not exceed the reasonable costs of providing that access.

(2) A fee collected by the California Privacy Protection Agency pursuant to paragraph (1) shall be deposited in the Data Brokers’ Registry Fund.

history: (History: Amended by Stats. 2025, Ch. 466, Sec. 3. (SB 361) Effective January 1, 2026.)

title: 1.81.48. Data Broker Registration


text:
(a) Except as provided in subdivision (b), the California Privacy Protection Agency may adopt regulations pursuant to the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code) to implement and administer this title.

(b) Notwithstanding subdivision (a), any regulation adopted by the California Privacy Protection Agency to establish fees authorized by this title shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code).

history: (History: Added by Stats. 2023, Ch. 709, Sec. 7. (SB 362) Effective January 1, 2024.)

title: 1.81.48. Data Broker Registration


text: Nothing in this title shall be construed to supersede or interfere with the operation of the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)).

history: (History: Added by Stats. 2019, Ch. 753, Sec. 2. (AB 1202) Effective January 1, 2020.)

title: 1.81.48. Data Broker Registration


text: No administrative action brought pursuant to this title alleging a violation of any of the provisions of this title shall be commenced more than five years after the date on which the violation occurred.

history: (History: Added by Stats. 2023, Ch. 709, Sec. 8. (SB 362) Effective January 1, 2024.)

title: 1.81.48. Data Broker Registration


text:
For purposes of this title, the following definitions apply:

(a) “Collect,” “collected,” or “collection” means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a natural person by any means. This includes receiving information from the natural person, either actively or passively, or by observing the natural person’s behavior.

(b) “Family planning center” means a facility categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services as defined in Section 1798.300.

(c) “Geofence” means any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation” as defined in subdivision (w) of Section 1798.140.

(d) “Health care services” means any service provided to a natural person of a medical, surgical, psychiatric, therapeutic, diagnostic, mental health, behavioral health, preventative, rehabilitative, supportive, consultative, referral, or prescribing nature.

(e) “Person” means a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert.

(f) “Personal information” has the same definition as that term is defined in subdivision (v) of Section 1798.140, except as applied to all natural persons and not limited to consumers and households, as those terms are defined in subdivisions (i) and (q), respectively, of that section.

(g) “Precise geolocation” means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person. If the geographic scope of the term “precise geolocation” as defined in Section 1798.140 is expanded beyond 1,850 feet, then that larger scope shall apply to this definition of precise geolocation.

(h) “Research” means systematic investigation, including research development, testing, and evaluation, that has as its primary purpose the development of, or contribution to, generalizable knowledge.

(i) “Sell,” “selling,” “sale,” or “sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party for monetary or other valuable consideration.

(j) “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party, whether or not for monetary or other valuable consideration.

history: (History: Amended by Stats. 2025, Ch. 134, Sec. 2. (AB 45) Effective January 1, 2026.)

title: 1.81.49. Health and Location Data Privacy


text:
(a) It shall be unlawful to collect, use, disclose, sell, share, or retain the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in subdivision (b) or as otherwise provided by law or in a collective bargaining agreement.

(b) Notwithstanding subdivision (a), it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person. All other prohibitions under subdivision (a) shall continue to apply.

(c) (1) An aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this section for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.

(2) If the court finds for the petitioner in an action authorized by paragraph (1), recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation.

(d) (1) This section does not apply to a provider of health care, a health care service plan, or contractor, as those terms are defined in Section 56.05 or to a covered entity or its business associate, as defined in Section 160.103 of Title 45 of the Code of Federal Regulations.

(2) In order to qualify for this exemption, a contractor or business associate must be contractually obligated to comply with all applicable state and federal privacy laws.

(e) (1) Nothing in this section shall be construed to alter applicable law, including pursuant to Section 3010 of the Penal Code, regarding use by a law enforcement agency of personal information, including geolocation information, generated by an electronic monitoring device.

(2) For purposes of this section, “law enforcement agency” means any department or agency of the state or any local government, special district, or other political subdivision thereof that employs any peace officer, as described in Chapter 4.5 (commencing with Section 830) of Title 3 of Part 2 of the Penal Code.

history: (History: Added by Stats. 2025, Ch. 134, Sec. 3. (AB 45) Effective January 1, 2026.)

path: 1.81.49. Health and Location Data Privacy


text:
(a) Except as provided in subdivision (f), it shall be unlawful to geofence an entity that provides in-person health care services in California for any of the following purposes:

(1) To identify or track a person seeking, receiving, or providing health care services.

(2) To collect personal information from a person seeking, receiving, or providing health care services.

(3) To send notifications to a person related to their personal information or health care services.

(4) To send advertisements to a person related to the person’s personal information or health care services.

(b) It shall be unlawful to sell personal information to, or share personal information with, a third party for the use of such information to violate subdivision (a). A statement signed under penalty of perjury, pursuant to Section 2015.5 of the Code of Civil Procedure, by a natural person authorized to enter into agreements on behalf of the third party that the personal information will not be used for these purposes shall be prima facie evidence that the personal information was not sold or shared in violation of this subdivision.

(c) Except as provided in subdivision (f), it shall be unlawful to use personal information obtained in violation of subdivision (a) or (b).

(d) (1) Any person that violates this section shall be subject to an injunction and liable for a civil penalty of twenty-five thousand dollars ($25,000) for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty.

(2) Any civil penalty recovered by an action brought by the Attorney General for a violation of this section, and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund established pursuant to Section 140 of the Health and Safety Code.

(e) This section shall be implemented consistent with state and federal law.

(f) (1) (A) This section does not prohibit any person that owns, operates, manages, or otherwise provides services to an in-person health care entity from geofencing the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals.

(B) This section does not prohibit any person that provides reproductive health care services, as defined in Section 1798.300, from utilizing geofencing for the purpose of providing security services to protect patients, staff, or property.

(2) Nothing in this section shall exempt any person from complying with any of the following:

(A) A lawfully executed search warrant.

(B) A lawful subpoena issued pursuant to existing California law.

(C) Law enforcement if law enforcement, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to such geofencing data. For purposes of this subparagraph, accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, shall not constitute being at risk or danger of death or serious physical injury.

(3) Nothing in this section abrogates or limits the requirements of the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).

(4) Nothing in this section shall apply to geofencing activities conducted solely for research purposes by an investigator within an institution that holds an assurance with the federal Department of Health and Human Services pursuant to Part 46 (commencing with Section 46.101) of Title 45 of the Code of Federal Regulations and who obtains informed consent in the method and manner required by those regulations.

(5) (A) This section does not prohibit geofencing activities conducted by a labor organization, as defined in Section 1117 of the Labor Code, or an employee organization, as defined in subdivision (a) of Section 3501 of, subdivision (a) of Section 3513 of, or subdivision (f) of Section 3562 of, the Government Code, if geofencing does not result in the labor union’s collection of names or personal information without the express consent of an individual and is for activities concerning workplace conditions, worker or patient safety, labor disputes, or organizing.

(B) A third party vendor, including, but not limited to, a social media platform, that collects personal information from a labor organization or employee organization pursuant to subparagraph (A) shall be prohibited from selling, using, or sharing that personal information for any purpose other than the activities described in subparagraph (A).

history: (History: Added by Stats. 2025, Ch. 134, Sec. 4. (AB 45) Effective January 1, 2026.)


text:
(a) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall be subject to the restrictions on release set forth in this section.

(b) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall not be released in response to a subpoena or request if that subpoena or request is based on either another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

(c) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall not be released to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (b):

(1) Enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

(2) Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

history: (History: Added by Stats. 2025, Ch. 134, Sec. 5. (AB 45) Effective January 1, 2026.)


text:
General Duties of Businesses that Collect Personal Information

(a) A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers of the following:

(1) The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section.

(2) If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used, and whether that information is sold or shared. A business shall not collect additional categories of sensitive personal information or use sensitive personal information collected for additional purposes that are incompatible with the disclosed purpose for which the sensitive personal information was collected without providing the consumer with notice consistent with this section.

(3) The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.

(b) A business that, acting as a third party, controls the collection of personal information about a consumer may satisfy its obligation under subdivision (a) by providing the required information prominently and conspicuously on the homepage of its internet website. In addition, if a business acting as a third party controls the collection of personal information about a consumer on its premises, including in a vehicle, then the business shall, at or before the point of collection, inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information are used, and whether that personal information is sold, in a clear and conspicuous manner at the location.

(c) A business’ collection, use, retention, and sharing of a consumer’s personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes.

(d) A business that collects a consumer’s personal information and that sells that personal information to, or shares it with, a third party or that discloses it to a service provider or contractor for a business purpose shall enter into an agreement with the third party, service provider, or contractor, that:

(1) Specifies that the personal information is sold or disclosed by the business only for limited and specified purposes.

(2) Obligates the third party, service provider, or contractor to comply with applicable obligations under this title and obligate those persons to provide the same level of privacy protection as is required by this title.

(3) Grants the business rights to take reasonable and appropriate steps to help ensure that the third party, service provider, or contractor uses the personal information transferred in a manner consistent with the business’ obligations under this title.

(4) Requires the third party, service provider, or contractor to notify the business if it makes a determination that it can no longer meet its obligations under this title.

(5) Grants the business the right, upon notice, including under paragraph (4), to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

(e) A business that collects a consumer’s personal information shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with Section 1798.81.5.

(f) Nothing in this section shall require a business to disclose trade secrets, as specified in regulations adopted pursuant to paragraph (3) of subdivision (a) of Section 1798.185.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 4. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)

title: 1.81.5. California Consumer Privacy Act of 2018


text:
Consumers’ Right to Delete Personal Information

(a) A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.

(b) A business that collects personal information about consumers shall disclose, pursuant to Section 1798.130, the consumer’s rights to request the deletion of the consumer’s personal information.

(c) (1) A business that receives a verifiable consumer request from a consumer to delete the consumer’s personal information pursuant to subdivision (a) of this section shall delete the consumer’s personal information from its records, notify any service providers or contractors to delete the consumer’s personal information from their records, and notify all third parties to whom the business has sold or shared the personal information to delete the consumer’s personal information unless this proves impossible or involves disproportionate effort.

(2) The business may maintain a confidential record of deletion requests solely for the purpose of preventing the personal information of a consumer who has submitted a deletion request from being sold, for compliance with laws or for other purposes, solely to the extent permissible under this title.

(3) A service provider or contractor shall cooperate with the business in responding to a verifiable consumer request, and at the direction of the business, shall delete, or enable the business to delete and shall notify any of its own service providers or contractors to delete personal information about the consumer collected, used, processed, or retained by the service provider or the contractor. The service provider or contractor shall notify any service providers, contractors, or third parties who may have accessed personal information from or through the service provider or contractor, unless the information was accessed at the direction of the business, to delete the consumer’s personal information unless this proves impossible or involves disproportionate effort. A service provider or contractor shall not be required to comply with a deletion request submitted by the consumer directly to the service provider or contractor to the extent that the service provider or contractor has collected, used, processed, or retained the consumer’s personal information in its role as a service provider or contractor to the business.

(d) A business, or a service provider or contractor acting pursuant to its contract with the business, another service provider, or another contractor, shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is reasonably necessary for the business, service provider, or contractor to maintain the consumer’s personal information in order to:

(1) Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the consumer, or reasonably anticipated by the consumer within the context of a business’ ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer.

(2) Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.

(3) Debug to identify and repair errors that impair existing intended functionality.

(4) Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.

(5) Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.

(6) Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the business’ deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if the consumer has provided informed consent.

(7) To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the consumer provided the information.

(8) Comply with a legal obligation.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 5. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)

path: 1.81.5. California Consumer Privacy Act of 2018


text:
Consumers’ Right to Correct Inaccurate Personal Information

(a) A consumer shall have the right to request a business that maintains inaccurate personal information about the consumer to correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information.

(b) A business that collects personal information about consumers shall disclose, pursuant to Section 1798.130, the consumer’s right to request correction of inaccurate personal information.

(c) A business that receives a verifiable consumer request to correct inaccurate personal information shall use commercially reasonable efforts to correct the inaccurate personal information as directed by the consumer, pursuant to Section 1798.130 and regulations adopted pursuant to paragraph (7) of subdivision (a) of Section 1798.185.

history: (History: Amended by Stats. 2024, Ch. 121, Sec. 1. (AB 3286) Effective January 1, 2025.)


text:
Consumers’ Right to Know What Personal Information is Being Collected. Right to Access Personal Information

(a) A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer the following:

(1) The categories of personal information it has collected about that consumer.

(2) The categories of sources from which the personal information is collected.

(3) The business or commercial purpose for collecting, selling, or sharing personal information.

(4) The categories of third parties to whom the business discloses personal information.

(5) The specific pieces of personal information it has collected about that consumer.

(b) A business that collects personal information about a consumer shall disclose to the consumer, pursuant to subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130, the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer, provided that a business shall be deemed to be in compliance with paragraphs (1) to (4), inclusive, of subdivision (a) to the extent that the categories of information and the business or commercial purpose for collecting, selling, or sharing personal information it would be required to disclose to the consumer pursuant to paragraphs (1) to (4), inclusive, of subdivision (a) is the same as the information it has disclosed pursuant to paragraphs (1) to (4), inclusive, of subdivision (c).

(c) A business that collects personal information about consumers shall disclose, pursuant to subparagraph (B) of paragraph (5) of subdivision (a) of Section 1798.130:

(1) The categories of personal information it has collected about consumers.

(2) The categories of sources from which the personal information is collected.

(3) The business or commercial purpose for collecting, selling, or sharing personal information.

(4) The categories of third parties to whom the business discloses personal information.

(5) That a consumer has the right to request the specific pieces of personal information the business has collected about that consumer.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 7. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)


text:
Consumers’ Right to Know What Personal Information is Sold or Shared and to Whom

(a) A consumer shall have the right to request that a business that sells or shares the consumer’s personal information, or that discloses it for a business purpose, disclose to that consumer:

(1) The categories of personal information that the business collected about the consumer.

(2) The categories of personal information that the business sold or shared about the consumer and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared.

(3) The categories of personal information that the business disclosed about the consumer for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

(b) A business that sells or shares personal information about a consumer, or that discloses a consumer’s personal information for a business purpose, shall disclose, pursuant to paragraph (4) of subdivision (a) of Section 1798.130, the information specified in subdivision (a) to the consumer upon receipt of a verifiable consumer request from the consumer.

(c) A business that sells or shares consumers’ personal information, or that discloses consumers’ personal information for a business purpose, shall disclose, pursuant to subparagraph (C) of paragraph (5) of subdivision (a) of Section 1798.130:

(1) The category or categories of consumers’ personal information it has sold or shared, or if the business has not sold or shared consumers’ personal information, it shall disclose that fact.

(2) The category or categories of consumers’ personal information it has disclosed for a business purpose, or if the business has not disclosed consumers’ personal information for a business purpose, it shall disclose that fact.

(d) A third party shall not sell or share personal information about a consumer that has been sold to, or shared with, the third party by a business unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt-out pursuant to Section 1798.120.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 8. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)


text:
Consumers’ Right to Opt Out of Sale or Sharing of Personal Information

(a) (1) A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. This right may be referred to as the right to opt out of sale or sharing.

(2) A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor shall comply with a consumer’s direction to the transferor made pursuant to this subdivision.

(b) A business that sells consumers’ personal information to, or shares it with, third parties shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be sold or shared and that consumers have the “right to opt out” of the sale or sharing of their personal information.

(c) Notwithstanding subdivision (a), a business shall not sell or share the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.

(d) A business that has received direction from a consumer not to sell or share the consumer’s personal information or, in the case of a minor consumer’s personal information has not received consent to sell or share the minor consumer’s personal information, shall be prohibited, pursuant to paragraph (4) of subdivision (c) of Section 1798.135, from selling or sharing the consumer’s personal information after its receipt of the consumer’s direction, unless the consumer subsequently provides consent, for the sale or sharing of the consumer’s personal information.

history: (History: Amended by Stats. 2024, Ch. 940, Sec. 1. (AB 1824) Effective January 1, 2025.)


text:
Consumers’ Right to Limit Use and Disclosure of Sensitive Personal Information

(a) A consumer shall have the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer’s sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services set forth in paragraphs (2), (4), (5), and (8) of subdivision (e) of Section 1798.140, and as authorized by regulations adopted pursuant to subparagraph (C) of paragraph (18) of subdivision (a) of Section 1798.185. A business that uses or discloses a consumer’s sensitive personal information for purposes other than those specified in this subdivision shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be used, or disclosed to a service provider or contractor, for additional, specified purposes and that consumers have the right to limit the use or disclosure of their sensitive personal information.

(b) A business that has received direction from a consumer not to use or disclose the consumer’s sensitive personal information, except as authorized by subdivision (a), shall be prohibited, pursuant to paragraph (4) of subdivision (c) of Section 1798.135, from using or disclosing the consumer’s sensitive personal information for any other purpose after its receipt of the consumer’s direction unless the consumer subsequently provides consent for the use or disclosure of the consumer’s sensitive personal information for additional purposes.

(c) A service provider or contractor that assists a business in performing the purposes authorized by subdivision (a) may not use the sensitive personal information after it has received instructions from the business and to the extent it has actual knowledge that the personal information is sensitive personal information for any other purpose. A service provider or contractor is only required to limit its use of sensitive personal information received pursuant to a written contract with the business in response to instructions from the business and only with respect to its relationship with that business.

(d) Sensitive personal information that is collected or processed without the purpose of inferring characteristics about a consumer is not subject to this section, as further defined in regulations adopted pursuant to subparagraph (C) of paragraph (18) of subdivision (a) of Section 1798.185, and shall be treated as personal information for purposes of all other sections of this act, including Section 1798.100.

history: (History: Amended by Stats. 2024, Ch. 121, Sec. 2. (AB 3286) Effective January 1, 2025.)


text:
Consumers’ Right of No Retaliation Following Opt Out or Exercise of Other Rights

(a) (1) A business shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights under this title, including, but not limited to, by:

(A) Denying goods or services to the consumer.

(B) Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.

(C) Providing a different level or quality of goods or services to the consumer.

(D) Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

(E) Retaliating against an employee, applicant for employment, or independent contractor, as defined in subparagraph (A) of paragraph (2) of subdivision (m) of Section 1798.145, for exercising their rights under this title.

(2) Nothing in this subdivision prohibits a business, pursuant to subdivision (b), from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if that difference is reasonably related to the value provided to the business by the consumer’s data.

(3) This subdivision does not prohibit a business from offering loyalty, rewards, premium features, discounts, or club card programs consistent with this title.

(b) (1) A business may offer financial incentives, including payments to consumers as compensation, for the collection of personal information, the sale or sharing of personal information, or the retention of personal information. A business may also offer a different price, rate, level, or quality of goods or services to the consumer if that price or difference is reasonably related to the value provided to the business by the consumer’s data.

(2) A business that offers any financial incentives pursuant to this subdivision, shall notify consumers of the financial incentives pursuant to Section 1798.130.

(3) A business may enter a consumer into a financial incentive program only if the consumer gives the business prior opt-in consent pursuant to Section 1798.130 that clearly describes the material terms of the financial incentive program, and which may be revoked by the consumer at any time. If a consumer refuses to provide opt-in consent, then the business shall wait for at least 12 months before next requesting that the consumer provide opt-in consent, or as prescribed by regulations adopted pursuant to Section 1798.185.

(4) A business shall not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 11. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)